Privacy notice
Version: 6 October 2026
Who handles your data
Honeysuckles Design LTD, trading as SitDownHQ, 72 Honeysuckles Avenue, Hailsham, BN27 4FP, United Kingdom. Privacy and complaints: info@sitdownhq.com. We are controller for business accounts, billing, support and platform security. For reservations and guest CRM, the restaurant is controller and SitDownHQ processes data on its instructions.
Data, purposes and legal bases
Name, email, optional contact details and booking information support your visit and service messages (contract or steps before a contract). Account and billing data provide the service and meet legal obligations. Limited security logs protect the service under legitimate interests. Marketing requires separate optional consent, withdrawn through the unsubscribe link. Health data is not used for marketing. We do not make solely automated decisions with legal or similarly significant effects.
Allergies and health information
Dietary information may reveal health information or religious beliefs. Provide it only with explicit consent for managing this visit. You can book without recording it online and discuss needs directly with the restaurant. Withdraw consent using the form or by contacting the restaurant; withdrawal does not affect earlier lawful processing. Do not place health information in general notes. Dietary details are removed 30 days after a completed, cancelled or missed visit unless a documented legal hold applies.
Recipients and transfers
Authorised restaurant staff access information needed for service. Technical providers may include Supabase (database and authentication), Vercel (hosting), Resend (email), Twilio (SMS) and Stripe (payments), depending on enabled features. Actual regions and transfer arrangements must be confirmed in the customer DPA and subprocessor register. Contact info@sitdownhq.com for current details. International transfers require adequacy or appropriate safeguards such as SCCs and the UK Addendum where applicable.
Retention
The restaurant sets guest retention (initial setting: 24 months). A scheduled process anonymises expired inactive profiles, excluding active bookings, open rights cases and documented legal holds. Billing and legal records follow separate obligations. Backups and provider copies have separate lifecycles; deletions must be reapplied after a restore. Ask the controller for the period applicable to your circumstances.
Rights and complaints
You can request access, correction, erasure, restriction, portability, objection and consent withdrawal. We verify identity proportionately before disclosing or changing data. Rights requests normally receive a response within one month; any permitted extension is explained within the first month. UK privacy complaints are acknowledged within 30 days, investigated without undue delay and updated with an outcome. You may complain to the UK ICO or Italy’s Garante without losing other remedies.